bingshuo/hololake-system-architecture
Watch
1
0
Fork
You've already forked hololake-system-architecture
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

fix: enforce one human one independent node

Browse source
This commit is contained in:
冰朔 2026-08-10 21:07:30 +08:00
commit cec261174d
32 changed files with 474 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

41
product-source/hololake-platform/docs/adr/0174-one-human-one-independent-node-and-zero-platform-hosting.md Normal file
View file

@ -0,0 +1,41 @@
---
status: accepted
date: 2026-08-10
---
# ADR 0174: One human, one independently operated node, and zero platform hosting
## Context
Earlier HoloLake documents used names such as `CLOUD_RESIDENT_NODE`, shared-node descriptions, and
platform-adjacent relay language. Those names left room to reinterpret an independently operated user node
as a Guanghu-hosted account or as a multi-tenant runtime. Repeated natural-language corrections did not
become a single machine-enforced invariant, so stale descriptions could reintroduce the wrong architecture.
## Decision
Each human has exactly one canonical, independently operated user node. That node runs in one of two modes:
1. `LOCAL_TERMINAL_NODE` on the user's own computer; or
2. `USER_OWNED_REMOTE_NODE` on a server owned or purchased by that user.
A remote node may be deployed by the Guanghu team only after the user explicitly authorizes deployment to
that user's own IDE server. Deployment assistance does not transfer ownership, custody, or operational
responsibility to Guanghu.
Guanghu provides zero user runtime servers, exposes no hosted-runtime tier, and does not place multiple
users on a pooled platform node. Guanghu does not custody private user data and does not absorb user workload
concurrency. Public routing metadata and software distribution are not user runtime hosting.
A server is optional. If a user's canonical node is offline, that user's runtime is offline; there is no
platform fallback. Moving the canonical node is a receipt-backed rebind, not the creation of a second root.
## Consequences
- Product and protocol surfaces must not advertise a Guanghu-hosted or shared multi-tenant user runtime.
- `CLOUD_RESIDENT_NODE` and shared-node aliases are rejected by the current runtime contract.
- Team-assisted deployment always targets a user-owned node and remains explicitly authorized.
- Availability and concurrency stay within the capacity and control of each user's node.
- Historical source quotations remain historical evidence, but current architecture, routing, runtime, and
generated agent instructions all follow this decision.

1
product-source/hololake-platform/docs/adr/README.md
View file

@ -224,3 +224,4 @@ proposed → active → superseded
| [0170](0170-hololake-inherits-guanghu-native-quality-authority.md) | HoloLake inherits the Guanghu native quality authority | accepted |
| [0171](0171-guanghu-protocols-are-automatic-runtime-and-engineering-laws.md) | Guanghu protocols are automatic runtime and engineering laws | accepted |
| [0172](0172-guanghu-cognitive-control-with-linux-execution-substrate.md) | Guanghu cognitive control with a constrained Linux execution substrate | accepted; supersedes ADR-0161 production path |
| [0174](0174-one-human-one-independent-node-and-zero-platform-hosting.md) | One human, one independently operated node, and zero platform hosting | accepted |